docs: correct a false compatibility claim, add the governance a standard needs

[fas89]

Two gaps between what this repository says about itself and what is true. Both are unblocked follow-ups to the conformance work in #44 and #45.

1. The 0.7.2 release note was wrong

docs/releases/0.7.2.md claimed "100% backward compatible with 0.7.1" and "No breaking changes". The compatibility gate added in #44 disproved it: $defs/notification gained additionalProperties: false, so a contract carrying any extra member on a build.execution.notifications[] entry validated under 0.7.1 and is rejected by 0.7.2.

build:
  execution:
    notifications:
      - type: slack
        target: "#data-alerts"
        condition: failure
        retryOnFailure: true   # accepted by 0.7.1, REJECTED by 0.7.2

The page now names the change, shows the contract that breaks, and links to the waiver holding the evidence. Finding a false claim and leaving it standing because it's old would make the gate decorative.

Also: docs/schema/versions.md said "the latest version is 0.7.4" and didn't list 0.7.5 at all — while 0.7.5 is published in schema/, announced in the README, and targeted by the entire conformance corpus. The public Schema Versions page was a release behind. Both linked 0.7.5 assets were confirmed present before linking them.

2. The repo had no governance files at all

0 of 5 — while forge-cli has 5/5 and forge-cli-sdk and flux-spec have 4/5. A repository describing itself as "the open, declarative standard for Data Products" offered no route to contribute and no way to report a vulnerability privately.

File	What it does
CONTRIBUTING.md	Leads with the rule that surprises everyone: schema/ is vendored from forge-cli, and a PR editing it gets reverted by the next sync. Says what is editable here, and sets the corpus bar as falsifiability, not case count.
GOVERNANCE.md	Steward-maintainer, stated plainly rather than dressed up as multi-vendor governance that doesn't exist. Names the conflict of interest — the maintainers also ship a commercial control plane on FLUID — and lists structural mitigations: MIT, no CLA, DCO, compatibility enforced by CI, ambiguities written down.
SECURITY.md	Private vulnerability reporting, with a threat model suited to a spec repo: a schema that fails open, a case that passes for the wrong reason, a gate that cannot fail.
CODE_OF_CONDUCT.md	Contributor Covenant 2.1, with a reporting route.

NOTICE is deliberately not added. It has to name a legal entity, and the estate currently carries five different copyright strings: "Agentics Transformation Limited" (forge-cli), "Agentics Transformation Pty Ltd" (forge-cli-sdk), "Ltd" (flux-engine), "The FLUX Project authors" (flux-spec), and "fluid-steward" (this repo's LICENSE). Picking one here would bake in a guess. That decision is yours — and it's the same one gating the Command Center licence fix.

3. Removed

fluid-schema-0.3.1 — a 12 KB JSON schema at the repo root with no .json extension, an $id pointing at open-data-protocol.org (not a domain we control) labelled v2.0, never present in schema/, never listed in versions.md, never rendered to specs/, referenced by nothing. Recoverable with git show 550dea8:fluid-schema-0.3.1 if you'd rather keep it.

Tested

This is the first PR to touch docs/**, so it's the first to trigger link-check. I ran its exact base-prefix rule locally — passes.

VuePress build is green, but that build exits 0 even when a page fails to render, so I checked the rendered HTML rather than the exit code:

• releases/0.7.2.html (34 KB) contains the correction and the retryOnFailure example
• the <h2> now reads "Backward compatibility with 0.7.1 — one narrowing change"
• the only surviving instance of "100% backward compatible" is inside the quoted correction
• schema/versions.html renders "latest version is 0.7.5", and both linked assets are present in dist/

Corpus 480/480, meta-test 19/19, compat gate clean.

Still open

required_status_checks on main is empty, so every gate in this repo — including the conformance suite — is advisory at merge time.

🤖 Generated with Claude Code